Serve static assets properly from nginx

The frontend nginx config is four lines: no gzip, no cache headers, no security headers, and every visitor re-downloads every hashed bundle on every visit. It also has an /api proxy block that never runs in prod because Traefik routes /api straight to the backend, so that can go.

• gzip on for text types (js, css, html, json, svg)
• Cache-Control: immutable, max-age 1 year for hashed /assets files, no-cache for index.html
• Basic security headers: X-Content-Type-Options, Referrer-Policy, X-Frame-Options
• Remove the dead /api proxy block
• Still worth it despite the Start migration eventually replacing nginx, it's a 20 minute change